Array AG Series VPN Vulnerability Exploited to Deploy Webshells

Threat actors are actively exploiting a command injection vulnerability in Array AG Series VPN devices,leading to the deployment of webshells and the creation of unauthorized user accounts. This poses a meaningful risk to organizations using these devices.

Vulnerability Details

Array networks addressed the vulnerability with a security update released in May. However, the lack of a formal vulnerability identifier (like a CVE number) hinders tracking and effective patch management. This makes it more arduous for security teams to prioritize and implement the necessary fixes.

Attacks Targeting japan

Japan’s Computer Emergency Response Team (CERT) issued an advisory detailing the exploitation of this vulnerability. they report attacks have been ongoing since at least August, specifically targeting organizations within Japan.

Attack Origin and Tactics

The attacks originate from the IP address 194.233.100[.]138, which is also used for command and control communications.JPCERT/CC has observed attackers attempting to place PHP webshell files in the following path: /ca/aproxy/webapp/. This allows them to gain remote access and control over the affected VPN devices.

Impact of Exploitation

Prosperous exploitation of this vulnerability allows attackers to:

• Deploy Webshells: Gain persistent remote access to the VPN device.
• Create Rogue Users: Bypass authentication and gain unauthorized access to the network.
• Potentially Compromise Network: Use the compromised VPN as a pivot point to attack internal network resources.

Mitigation and Recommendations

Organizations using Array AG Series VPN devices should take the following steps immediately:

• Apply the May Security Update: this is the moast critical step to address the vulnerability.
• Monitor Network Traffic: Look for suspicious activity originating from or destined for the IP address 194.233.100[.]138.
• Review VPN Logs: Examine VPN logs for any signs of unauthorized access or suspicious commands.
• Implement Strong Authentication: Enforce multi-factor authentication (MFA) for all VPN users.

FAQ

Q: What is a webshell?

A: A webshell is a malicious script that allows an attacker to execute commands on a web server. It provides remote access and control over the compromised system.

Q: What is a command injection vulnerability?

A: A command injection vulnerability occurs when an application allows an attacker to inject arbitrary commands into a system. This can lead to unauthorized access and control.

Q: Is my organization at risk if it’s not in Japan?

A: While the initial attacks were focused on Japan, the vulnerability is global.Organizations worldwide using array AG Series VPN devices are potentially at risk.

key Takeaways

• A command injection vulnerability exists in Array AG Series VPN devices.
• Attackers are actively exploiting this vulnerability to deploy webshells and create rogue users.
• Organizations should immediately apply the May security update and monitor thier networks for suspicious activity.
• The lack of a CVE identifier complicates patch management.

This vulnerability highlights the importance of timely patching and proactive security measures. As VPNs remain a critical component of remote access infrastructure, continued vigilance and rapid response to emerging threats are essential to protect organizational networks.